Why recurring reviews exist
User access reviews are the control that turns "who has access" from a snapshot into a living answer. Regulators, auditors and security frameworks (SOC 2, ISO 27001, NIST) expect organisations to periodically confirm that every account still needs the access it holds — and to keep evidence of that confirmation.
Scoping a review
Before opening a review, decide what is in scope:
- Applications: which SaaS applications and directories are included.
- Populations: employees, contractors, external collaborators, service accounts.
- Attributes: licences, roles, group memberships, sign-in activity, privileged flags.
A common mistake is reviewing everything at once. Start with the highest-risk surface: privileged roles, external users and licensed-but-inactive accounts.
Choosing a cadence
- Monthly: licence-heavy environments where seat cost is material.
- Quarterly: the default for most organisations.
- Annually: minimum compliance cadence for many frameworks.
Whatever cadence you choose, the review window must be short enough that reviewers can complete it while the data is still current.
What evidence to keep
- The review window and the data snapshot it was based on.
- Who was asked to review, and when.
- Each decision (approve, revoke, defer) with the reviewer and timestamp.
- Exceptions and their rationale.
Evidence should be immutable: once a decision is recorded it must not be editable, so an auditor can trust the record.
Common failure modes
- Reviewer fatigue: too many users per review leads to rubber-stamping. Split by owner or application.
- Stale data: reviewing against a month-old snapshot misses changes.
- No follow-through: decisions to revoke are never actioned. Track revocation to completion.